Can you e-sign a medical consent form?
Usually, yes. Federal e-signature law doesn't exclude medical consent forms, and the HIPAA Privacy Rule expressly allows authorizations to be signed electronically when the e-signature is valid under applicable law. The rules tighten for consent to take part in clinical research, where FDA-regulated studies need electronic signatures that meet 21 CFR Part 11. State informed-consent law and your own organization's policies sit on top.
Updated November 5, 2026 · 4 min read
On this page
Three kinds of medical consent form
| Form | Main rules | E-signature |
|---|---|---|
| Consent to treatment or a procedure | State informed-consent law and the provider's policies | Generally allowed under ESIGN and UETA, unless a state rule says otherwise |
| HIPAA authorization to use or disclose health information | HIPAA Privacy Rule, 45 CFR 164.508 | Allowed when the e-signature is valid under applicable law (HHS) |
| Informed consent to join a clinical study | 45 CFR part 46 and, for FDA-regulated studies, 21 CFR parts 50 and 11 | Allowed; FDA-regulated studies need Part 11-compliant e-signatures |
Consent to treatment
The ESIGN Act's exceptions cover wills, family law, most of the Uniform Commercial Code, court papers and specific notices, including cancellation of health insurance or benefits (15 U.S.C. § 7003). Consent to treatment isn't on the list, and neither is it among UETA's uniform exclusions. So a patient's e-signature on a consent form can carry the same weight as ink, provided the patient agreed to sign electronically.
Some states say so expressly. Indiana's version of UETA confirms that electronic signature authentication may be used for health information transactions, including consent to treatment and health care directives (IC 26-2-8-116); see our Indiana page. What informed consent requires, such as which risks to explain and who explains them, comes from state law and medical standards, not from the signature method. The conversation still has to happen.
HIPAA authorizations
When a provider or health plan needs a patient's written authorization, for example to send records to a lawyer or use them in marketing, the Privacy Rule requires specific contents, including the patient's signature and the date (45 CFR 164.508(c)). The U.S. Department of Health and Human Services has addressed the format directly:
the Privacy Rule allows HIPAA authorizations to be obtained electronically from individuals, provided any electronic signature is valid under applicable law.
The same answer notes that a covered entity may act on an electronic copy of a valid, signed authorization. Treatment, payment and health care operations generally don't need an authorization at all.
Clinical research consent
The FDA and HHS's Office for Human Research Protections issued joint guidance in 2016 on electronic informed consent. It says their regulations permit electronic signatures when written informed consent is required. OHRP accepts electronic signatures that are legally valid where the research takes place. For FDA-regulated clinical investigations, an electronic signature must meet all applicable requirements of 21 CFR part 11 to count as the equivalent of a handwritten one, and the system must record the date the subject or their representative consented (21 CFR 50.27(a)).
Part 11 is about systems, not just signatures: validation, audit trails, access controls and signature manifestations. The guidance also asks how a remote system confirms that the person signing is the subject or their representative. Sponsors and sites use systems validated for those requirements.
Getting it right in a clinic
- 1
Get agreement to sign electronically
Ask the patient to agree to electronic records and signatures before the form, and offer paper to anyone who'd rather.
- 2
Explain, then sign
Have the clinician talk through the procedure first. The form records the consent; it doesn't replace the conversation.
- 3
Confirm who's signing
For a minor or a patient who lacks capacity, have the parent, guardian or authorized representative sign in their own name.
- 4
File it with the chart
Store the signed form, its audit trail and the date in the patient's record.
Common mistakes
- Staff signing for the patient. Hand the patient the device or send them the link. A signature someone else applied proves nothing about the patient's consent.
- Pre-checked boxes. Each consent statement should be something the patient actively chooses, not a box that arrives already ticked.
- Incomplete HIPAA authorizations. An e-signature doesn't fix a form missing a required element, such as who will receive the information or when the authorization expires (45 CFR 164.508(c)).
- Separating the form from its record. Keep the audit trail with the signed form, so you can show when and how the patient signed.
Where SignMaster fits
Med spas, chiropractors and massage therapists can send intake and consent forms through SignMaster, or have clients sign on a tablet at the front desk with in-person signing. Each signer agrees to sign electronically first, and the signed PDF carries a certificate of completion with the signing time and IP address. Be clear about its limits: SignMaster doesn't claim HIPAA compliance or 21 CFR Part 11 validation, so check with your compliance lead before putting protected health information through it, and use a validated system for FDA-regulated research.
Questions? Answers.
Is an electronically signed consent form legally valid?
Generally, yes. ESIGN and UETA don't exclude consent to treatment, and a state like Indiana says so expressly. State informed-consent rules still decide what the patient must be told.
Can a HIPAA authorization be signed electronically?
Yes. HHS says the Privacy Rule allows HIPAA authorizations to be obtained electronically, provided the electronic signature is valid under applicable law. The form still needs every element 45 CFR 164.508 requires.
What does 21 CFR Part 11 require for e-consent?
For FDA-regulated clinical investigations, electronic signatures must meet Part 11 to count as equivalent to handwritten ones, and the system must capture the date of consent. Sponsors use systems validated for that purpose.
Can a telehealth consent be signed electronically?
Generally, yes, under the same rules as any treatment consent. Send the form before the visit so the patient can read it and sign from their own phone, and check your state's telehealth rules for what the consent has to cover.
Can a parent e-sign a consent form for a child?
Usually, where state law lets that parent consent for the child. Have the parent sign as themselves, naming the child, rather than signing the child's name.
Sources
- 15 U.S.C. § 7001, ESIGN Act general rule and consumer consent (govinfo) · govinfo.gov
- 15 U.S.C. § 7003, ESIGN Act exceptions (govinfo) · govinfo.gov
- Uniform Electronic Transactions Act (1999), final text (Uniform Law Commission) · uniformlaws.org
- HHS, How do HIPAA authorizations apply to an electronic health information exchange environment? · hhs.gov
- 45 CFR 164.508, uses and disclosures requiring an authorization (govinfo) · govinfo.gov
- FDA and OHRP, Use of Electronic Informed Consent in Clinical Investigations: Questions and Answers (2016) · fda.gov
General information, not legal advice. Laws change, and how they apply depends on your situation. For advice about a specific document, talk to a lawyer licensed where you are.